zulip-0001: user_groups.py lock_subgroups_with_respect_to_supergroup group_ids_found list O(G*F) -> set O(G+F), 142x at N=1000
zulip-0002: user_groups.py update_user_group group_ids_found list O(D*F) -> set O(D+F), 76x at N=1000
zulip-0003: actions/user_groups.py update_users_in_full_members_system_group full_member_group_user_ids list O(M*F) -> set O(M+F), 55x at N=1000
Previous shallow scan marked CLEAN; deeper scan found all 3. MOAD-0002/0003/0004/0005 CLEAN.
3/3 unit tests PASS.
getauth() in usersmtp.c logs all SASL auth fields including password
verbatim when tTd(95,5) debug flag is active. Fix: redact password
field with <REDACTED> at log serialization layer. 6/6 tests PASS.
MOADs 0001/0002/0003/0005 CLEAN.
pgbouncer-0001 (CWE-312 SCRAM verifier logged at slog_debug) was already documented.
pgbouncer-0002: find_database() uses statlist_for_each + strcmp O(D) on every new
client connection login path. find_global_user() uses aatree_search O(log U) but
DB lookup was never upgraded. Fix: AA-tree or hash index mirroring user_tree pattern.
100x op-count at D=100, 1000x at D=1000. Test PASS. MOADs 0002/0003/0005 CLEAN.
MOAD-0001 (CWE-407): CLEAN. AC trie, BM hash, and hash tables used throughout
our hot scan paths. No linear membership scan in our critical code paths.
MOAD-0002 (Intertangle): CLEAN. cl_engine is read-only during scan;
cli_ctx is stack-local per scan_common invocation.
MOAD-0003 (Leaked Context): CLEAN. No pthread thread-locals for scan
identity; cli_ctx is per-scan-invocation stack variable.
MOAD-0004 (Logged Secret): clamav-0001 — create_curl_handle() in
libfreshclam/libfreshclam_internal.c:735 logs g_proxyPassword verbatim
in our LOGG_ERROR path when curl_easy_setopt(CURLOPT_PROXYPASSWORD) fails.
FreshClam logs are world-readable by default on Linux. Fix: remove our
credential from our error message, retain our option name for debugging.
MOAD-0005 (Thundering Herd): CLEAN. cache.c uses splay-tree-per-bucket
with pthread_mutex_t protecting each bucket on every access.
jitsi-meet-0003: av-moderation pendingAudio/Video/Desktop Array.find()
dedup O(P^2) in large moderated meetings — 249.5x op-count at P=500,
138.5x measured at P=2000. Fix: Map<id, participant> for O(1) dedup.
jitsi-meet-0004: visitors middleware delta Array.findIndex() per update
O(U*V) in large broadcast events — 15x at V=5000 U=1000. Fix: Map-based
apply-delta O(1) per join/leave.
solvespace-0002: VRML export colours_present std::vector + find_if
O(T*C) per triangle — 250x op-count at T=50k C=500. Fix: unordered_map
keyed by ToPackedInt() RGBA uint32.
MOAD-0002/0003/0004/0005: CLEAN for both targets.
All 13 unit tests PASS.
libjpeg-turbo-0001: rdcolmap.c add_map_entry() O(P*C) linear color dedup.
For each pixel in a PPM colormap file, a linear scan checks the palette
(up to 256 entries). With large images (JPEG_MAX_DIMENSION=65500) and a
saturated palette, cost reaches O(W*H*256). Fix: open-addressing hash set
resets once per _read_color_map() call, giving O(1) average per pixel.
Measured 128-131x speedup. 7/7 unit tests PASS.
libwebp: CLEAN on all 5 MOADs. GetColorPalette uses open-addressing hash,
backward references use hash chains, palette sort O(N^2) bounded to N<=256
once per image, DSP init uses mutex-protected lazy initialization.
cmake-0005: cmQtAutoGen MergeOptions std::find over baseOpts in newOpts loop, O(N*M), 31.5x at N=M=50
cmake-0006: cmVisualStudio10TargetGenerator FinishWritingSource writtenSettings O(S^2), 15.3x at S=30
cmake-0007: cmGeneratorExpressionNode TargetRuntimeDllDirsNode dllDirs O(D^2), 10.3x at D=100
MPD: all 5 MOADs CLEAN; updated CLEAN.md with MOAD-0002 through MOAD-0005 analysis.
Unit tests: 3/3 PASS.
freecad-0003: CrossSection::removeDuplicates O(W^2*E) wire dedup via
std::find_if over growing list; fix: hash-keyed seen-set O(W*E log E).
Severity MEDIUM-HIGH, ~200x at W=400 duplicate wires.
freecad-0004: SketchAnalysis::detectMissingEqualityConstraints O(C*M^2)
std::find_if over std::list of equal-line/radius candidates; fix:
unordered_multimap keyed on canonical (GeoId,GeoId) pair, O(C).
Severity MEDIUM-HIGH, ~5x at C=50/M=50, grows with M^2.
kicad-0003: BOARD_NETLIST_UPDATER::testConnectivity calls FindPadByNumber
(O(P) linear scan) for each of N pins per footprint; fix: build
unordered_map<padNumber,PAD*> once per footprint, O(P+N) total.
Severity HIGH, ~19x at P=256 pads, ~512x at P=512 pads.
MOAD-0002/0003/0004/0005: CLEAN for both projects (documented in SCAN-NOTES).
mgba-0001: SM83DebuggerCheckBreakpoints() O(N) linear scan per GB/GBC
CPU instruction — no bloom filter guard, unlike ARMDebugger which already
has bpBloom[4]. Fix: add identical bloom guard to SM83Debugger.
Op-count ratio 10.4x at N=16 breakpoints (PASS).
snes9x: CLEAN across all 5 MOADs. Breakpoint array is fixed size-6 (O(1)).
Cheat apply is per-frame O(G*C), not per-instruction. No credential logging.
libtiff-0001: TIFFReadDirectory + TIFFReadCustomDirectory both contain
identical O(D^2) nested loops to detect duplicate IFD tags (bugzilla 1994
dedup block, tif_dirread.c). Adversarial TIFF with D=65535 entries causes
~2.1B comparisons per IFD open. Fix: sorted seen-array with binary-search
insert, O(D log D). Java model confirms 37x at D=8000; asymptotic ~3900x
at D=65535.
libpng: all 5 MOADs CLEAN. add_one_chunk O(new*old) in pngset.c is bounded
by a ~30-entry fixed chunk list; chunk dedup during read uses a bitmask O(1).
obs-studio: CLEAN all 5 MOADs
- MOAD-0001: no std::find in render hot path; da_find() calls are UI-only
- MOAD-0002: clean subsystem separation via handle interfaces
- MOAD-0003: THREAD_LOCAL vars are thread-type markers, not request identity
- MOAD-0004: stream key never logged; RTMP playpath log guarded by level filter
- MOAD-0005: async_cache fully mutex-protected
synfig-0001: CWE-407 in remove_layers_inside_included_pastelayers()
- std::vector<Layer::Handle> + std::find inside ancestor-walk while loop
- O(L * D * P): L layers, D nesting depth, P paste-canvas count
- Fix: std::unordered_set<Layer*> reduces inner lookup from O(P) to O(1)
- 4/4 unit tests PASS, 2.4x speedup at P=2000
llamacpp-0001: llama-grammar.cpp advance_stack/accept_token stacks_new
dedup via std::find on vector<vector<ptr>>, O(S^2) per grammar-constrained
token. Fix: companion std::set<llama_grammar_stack> for O(S log S). ~16x at S=300.
aria2-0001: DHTPeerAnnounceEntry addPeerAddrEntry peerAddrEntries_ vector
std::find dedup, O(P^2) as DHT peers accumulate per infohash. Fix:
unordered_map keyed by ip:port for O(P) amortized. ~15x at P=3000.
Both: MOADs 0002-0005 CLEAN per scan markers.
Both targets scanned across all 5 MOADs. No defects found.
NetworkManager: single-threaded GLib main loop, no hot-path O(N^2) scans,
all WiFi PSK/EAP/VPN secrets guarded with "<hidden>" in supplicant config log.
avahi: single-threaded poll loop, hashmap-based record and lookup caching,
no credentials, no thread-local context, no concurrent cache patterns.
digikam-0003 CWE-407: MetaEngine/DMetadata addToXmpTagStringBag and
removeFromXmpTagStringBag call QStringList::contains() inside a loop over
existing entries — O(O*N) per image during batch metadata write.
Fix: build QSet<QString> before the loop for O(1) lookup.
17x speedup at K=200 keywords (unit test PASS).
digikam-0004 CWE-312: O2::onVerificationReceived logs the full OAuth2
token exchange POST body (including client_secret_) via qDebug() at
GrantFlowAuthorizationCode completion — exposes cloud service credentials
in debug logs/stderr for Google Photos, Flickr, OneDrive integrations.
Fix: replace full-body dump with redacted log line.
lmms: all 5 MOADs CLEAN — std::find uses are non-hot, contains() calls
are on QHash/QMap/QSet, no credential logging, no leaked thread context,
no unsynchronized cache access.
kdenlive: all 5 MOADs scanned.
- MOAD-0001: 8 pre-existing CWE-407 patches confirmed, no new sites found.
- MOAD-0002: pCore god object (3704 refs) noted as Intertangle observation.
- MOAD-0003: CLEAN (thread_local is execution guard, not request identity).
- MOAD-0004: CLEAN (no credential logging).
- MOAD-0005 NEW: buildLumaThumbs() called via QtConcurrent::run() writes
to MainWindow::m_lumacache (QMap, not thread-safe) without mutex while UI
widgets read/write the same map from the main thread — data race on project
load. Patch: add QMutex, wrap all m_lumacache access sites.
audacity: all 5 MOADs scanned.
- MOAD-0001: 2 pre-existing CWE-407 patches confirmed, no new sites found.
- MOAD-0002 through MOAD-0005: CLEAN.
9/9 KdenliveTest PASS (added kdenlive-0009 MOAD-0005 threading test).
ffmpeg-0004 (MOAD-0004 / CWE-312): libavformat/http.c http_connect() logs the full
HTTP request at AV_LOG_DEBUG, including the Authorization: Basic header with
base64-encoded user:pass. Fix: produce a sanitized copy before av_log, replacing
auth header values with ***REDACTED***. Wire bytes unchanged. 22/22 unit tests PASS.
FFmpeg MOADs 0002/0003/0005: CLEAN. ImageMagick MOADs 0002-0005: CLEAN.
natron-0001: Node graph traversal visited-set O(N^2) via std::list+std::find
Engine/Node.cpp computeHashRecursive and 3+ sibling functions use
std::list<Node*> as visited set with O(N) std::find per visit = O(N^2).
Fix: std::unordered_set<Node*>. 249.5x at N=500 nodes. 3/3 PASS.
ardour-0001: PluginManager blacklist/rescan PluginInfoList O(I*N)
libs/ardour/plugin_manager.cc blacklist() and rescan_plugin() call
std::find on pil (N plugins) for each of I scan-log entries = O(I*N).
Fix: unordered_set + remove_if. 19.4x at N=1000 I=20. 3/3 PASS.
MOADs 0002-0005: CLEAN with notes in SCAN-MOAD-0002-0005.md each.
gimp-0003: xcf_save_layer_props layer_sets O(L×S×I) MEDIUM 166.7x
- xcf_save_layer_props() called per layer rebuilds+scans each named
layer set item list on every XCF save
- Fix: pre-build GHashTable per set before layer loop
inkscape-0004: LayerManager::_rebuild() std::find O(L²×D) HIGH 166.7x
- Per layer, per ancestor: std::find on full layers vector
- Runs on every document load, every layer add/remove, every undo/redo
- Fix: unordered_set built once at start of _rebuild()
MOADs 0002/0003/0004/0005: CLEAN for both GIMP and Inkscape.
All 3/4 unit tests PASS respectively.
blender-0004: MOAD-0001 CWE-407 anim_channels_edit.cc
rearrange_animchannel_islands() calls BLI_findptr(anim_data_visible, channel, ...)
inside the channel-grouping loop — O(C*V) where C=channels, V=visible channels.
In a complex rig: C=V=1000, 1,000,000 pointer comparisons per reorder.
Fix: build blender::Set<void*> from anim_data_visible before loop, O(1) lookup.
Measured: 250x op-count ratio at C=V=1000.
darktable-0004: MOAD-0004 CWE-312 pwstorage backends
backend_kwallet.c and backend_apple_keychain.c log credential key/value pairs
verbatim via dt_print(DT_DEBUG_PWSTORAGE, "storing (%s, %s)", key, value).
`value` for Piwigo export is JSON including plaintext password.
Triggered by `darktable -d pwstorage` or `-d all` (common debugging mode).
Fix: replace value argument with "[REDACTED]" in all four dt_print calls.
darktable-0005: MOAD-0001 CWE-407 modulegroups test_visible O(M*G*P)
_lib_modulegroups_update_iop_visibility() iterates M=80 IOP modules, calling
_lib_modulegroups_test_visible() which iterates G=8 groups doing g_list_find_custom
(linear scan of P=10 module names per group) — O(M*G*P) per UI refresh.
Called on every search keystroke, module toggle, and group switch.
Fix: precompute GHashTable of all visible module names; test_visible = O(1).
Measured: 37.8x op-count ratio at M=80, G=8, P=10.
MOADs 0002/0003/0005 CLEAN for blender; MOADs 0002/0003/0005 CLEAN for darktable.
All 4 blender + 5 darktable unit tests PASS.
